Ask HN: Master password to one password per site with bcrypt algorithm
I created a password utility for myself a while ago that is becoming increasingly useful. I'm looking at turning it into a small web service, as well as open-source offline script but obviously the core algorithm is rather important (and at the moment - may be flawed).
I've uploaded the source as a gist if anyone cares to comment: https://gist.github.com/4088402
Basically it generates a bcrypt hash using the site name and the password, and then uses the value of the hash to pick out a ten letter password according to certain specifications (starts with a letter, contains atleast one other letter, one number and one symbol).
It seems like having the hash only dependent on the site name is a bad idea... but I'm not sure what other choice there is. Having the password influence it would make it significantly cheaper to find the password (which is way more important), but having just the salt there means any users using the same site name which will happen often - will have same salt.
There are plans for a number of very useful features (saving comments with passwords, verifying the master password when generating, etc.) but all of that can only come once the core algorithm is nailed - because that will be very hard to change.